How was my server accessed without authorization / can you find who?
If someone got into your server without permission, the panel and your in-game logs hold most of the answers. This article walks through where to look, the usual causes, and how to lock things down.
Where to look
Start by gathering evidence before you change anything.
- Open the Activity tab — the panel's audit log records power actions, file changes, and other panel-level events.
- Check your in-game logs: CoreProtect (if installed) for block/inventory history, and the raw
logs/folder from the Files tab for connections and commands.
Together these show what happened, even when they cannot always show who by name.
Common causes and fixes
Unauthorized access almost always traces back to one of these.
- A shared or leaked panel password — change your password immediately.
- A subuser with too many permissions — review the Users tab and trim access to only what each person needs.
- OP handed to the wrong person — audit your operators and de-op anyone who should not have it.
- An offline-mode ("cracked") server without auth — anyone can log in using any username, so enable an auth/login plugin or a whitelist.
Tip: On cracked servers, a whitelist plus a login-auth plugin is the single biggest security upgrade you can make.
Frequently asked questions
Can you tell me exactly who did it? Not always. We cannot reliably identify a specific individual, but the Activity log and in-game logs show the actions that were taken, which usually points to the cause.
What should I do first? Change your panel password, then review the Users tab and your OP list. Most incidents come from access that was broader than it needed to be.
How do I stop name impersonation? If you run an offline-mode server, add a whitelist and an authentication plugin so a username alone is not enough to get in.